chore(deps): bump httpx2 from 2.10.0 to 2.12.0

[dependabot]

Bumps httpx2 from 2.10.0 to 2.12.0.

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• See full diff in compare view

[lelia]

Dependabot (@dependabot) rebase